Closing the Gap: Achieving Better Accuracy-Robustness Tradeoffs against Query-Based Attacks

Abstract

Although promising, existing defenses against query-based attacks share a common limitation: they offer increased robustness against attacks at the price of a considerable accuracy drop on clean samples. In this work, we show how to efficiently establish, at test-time, a solid tradeoff between robustness and accuracy when mitigating query-based attacks. Given that these attacks necessarily explore low-confidence regions, our insight is that activating dedicated defenses, such as random noise defense and random image transformations, only for low-confidence inputs is sufficient to prevent them. Our approach is independent of training and supported by theory. We verify the effectiveness of our approach for various existing defenses by conducting extensive experiments on CIFAR-10, CIFAR-100, and ImageNet. Our results confirm that our proposal can indeed enhance these defenses by providing better tradeoffs between robustness and accuracy when compared to state-of-the-art approaches while being completely training-free.

arXiv commentTo appear in the Proceedings of the AAAI Conference on Artificial Intelligence (AAAI) 2024

References in corpus (18)

• Explaining and Harnessing Adversarial Examples
• On Calibration of Modern Neural Networks
• Towards Deep Learning Models Resistant to Adversarial Attacks
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Theoretically Principled Trade-off between Robustness and Accuracy
• Synthesizing Robust Adversarial Examples
• Adversarially Robust Generalization Requires More Data
• Countering Adversarial Images using Input Transformations
• Learning Confidence for Out-of-Distribution Detection in Neural Networks
• Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examples
• Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Models
• A Closer Look at Accuracy vs. Robustness
• Improving Transferability of Adversarial Examples with Input Diversity
• HopSkipJumpAttack: A Query-Efficient Decision-Based Attack
• Towards Robust Neural Networks via Random Self-ensemble
• Once-for-All Adversarial Training: In-Situ Tradeoff between Robustness and Accuracy for Free
• Random Noise Defense Against Query-Based Black-Box Attacks
• PopSkipJump: Decision-Based Attack for Probabilistic Classifiers